Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

69320

Tracked CVEs

6432

Critical

702

Exploited in wild

4480

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1587
4CVE-2026-99999Critical· 9.3In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network hea…963
5CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab267
6CVE-2026-108707Critical· 9.8Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header266
7CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

50 matches

CVE-2024-6423Medium· 4.0

1w ago

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its a…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.10%via CVEORG

CVE-2024-5139Medium· 6.1

1w ago

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpo…

▾ SunlitWSO2 · WSO2 Enterprise IntegratorEPSS 0.23%via CVEORG

CVE-2024-5563Medium· 4.8

1w ago

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, …

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.19%via CVEORG

CVE-2024-4989Medium· 5.4

1w ago

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web p…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.17%via CVEORG

CVE-2024-7478Medium· 5.8

1w ago

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the auth…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.24%via CVEORG

CVE-2025-0326None

1w ago

Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previ…

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.14%via CVEORG

CVE-2024-2323Medium· 4.8

1w ago

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user accoun…

▾ SunlitWSO2 · WSO2 Enterprise IntegratorEPSS 0.23%via CVEORG

CVE-2025-7043Medium· 5.4

1w ago

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requ…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.18%via CVEORG

CVE-2025-6623Medium· 4.3

1w ago

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary Java…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.27%via CVEORG

CVE-2025-7203Medium· 4.9

1w ago

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure…

▾ SunlitWSO2 · WSO2 Universal GatewayEPSS 0.15%via CVEORG

CVE-2025-10149High· 8.2

1w ago

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user …

▾ TwilightWSO2 · WSO2 Identity Server as Key ManagerEPSS 0.18%via CVEORG

CVE-2025-13591Medium· 5.3

1w ago

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in r…

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.30%via CVEORG

CVE-2025-13173Medium· 6.5

1w ago

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation an…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.19%via CVEORG

CVE-2024-4412Low· 2.7

1w ago

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploit…

▾ SunlitWSO2 · WSO2 Enterprise IntegratorEPSS 0.37%via CVEORG

CVE-2024-4457Critical· 9.1

1w ago

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected…

▾ MidnightWSO2 · WSO2 Enterprise IntegratorEPSS 0.42%via CVEORG

CVE-2024-8122Medium· 5.9

3w ago

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA)

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious ac…

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.25%via NVD

CVE-2026-19515High· 7.0

1mo ago

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary op…

▾ TwilightWSO2 · WSO2 Integrator: MI for Visual Studio CodeEPSS 0.17%via NVD

CVE-2025-5802Medium· 5.3

1mo ago

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error messag…

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.33%via NVD

CVE-2025-13166Low· 3.7

1mo ago

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.27%via NVD

CVE-2026-4103Medium· 6.4

1mo ago

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affec…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.30%via NVD

CVE-2026-3096Medium· 4.7

1mo ago

The product's web portals allow external links to be opened in a new browser tab

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navig…

▾ SunlitWSO2 · WSO2 API Control PlaneEPSS 0.29%via NVD

CVE-2026-3416Medium· 5.9

1mo ago

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a s…

▾ Sunlitwso2 · api_control_planeEPSS 0.36%via NVD

CVE-2025-12737High· 8.4

1mo ago

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Succe…

▾ Twilightwso2 · api_control_planeEPSS 0.37%via NVD

CVE-2025-14779Low· 3.8

2mo ago

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associ…

▾ Sunlitwso2 · identity_serverEPSS 0.32%via NVD

CVE-2025-15039Critical· 9.4

2mo ago

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows…

▾ Midnightwso2 · api_control_planeEPSS 0.67%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA)

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

The product's web portals allow external links to be opened in a new browser tab

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA)

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization

The product's web portals allow external links to be opened in a new browser tab

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial